193b977ebb084206d437733925bb0cd20911c89eb31a99eec04d636372f40221

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8f2699782a42c70e04af9cc4b98c36a_JaffaCakes118.html
Size

27KB
MD5

c8f2699782a42c70e04af9cc4b98c36a
SHA1

b1de8809ae970f965e6cdf8968f8e386481c477c
SHA256

193b977ebb084206d437733925bb0cd20911c89eb31a99eec04d636372f40221
SHA512

d51f131d47cf366b0a02338f5916f27e742151f35a8a0b7093d68bcc91c5898814338d47bea5e9b37b923d2d68365c52f86432b88c568d40daef2712d3eeb553
SSDEEP

192:uw7cb5nJanQjxn5Q/YnQieDNn3nQOkEntISnQTbn9nQ9eTPm6lf9/Ql7MBjqnYnP:IQ/z+x99+SZC6l

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431101291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2944241-660D-11EF-A74E-76B5B9884319} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
708	iexplore.exe
708	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 2772	708	iexplore.exe	29
PID 708 wrote to memory of 2772	708	iexplore.exe	29
PID 708 wrote to memory of 2772	708	iexplore.exe	29
PID 708 wrote to memory of 2772	708	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8f2699782a42c70e04af9cc4b98c36a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cc85ffb62afa5fcd76d91b76d6c22b2

SHA1
cf312549619cbe7dd3037c43becb23aac2a2d708

SHA256
f3d9bce145a84dd34794e83fa4a14aa54f03e0083ebaf875b56e4e62c2ac06a7

SHA512
edfb576cd119c6053f3684f765ad32cd3938bef938d8141e5735f49feb34485b980a43c8c6bc9eee11bed91b7e31ec76f2e84350a90873c5febe9b427a870e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
892e55c9b3bc5f831403cccf11c4f5e3

SHA1
4e8f64c1725a474a66d6d62b3644ed5ae324377b

SHA256
3f8a8edc6f43111860b1ad4131b93dd0cf18d4c8217ee4f742f0e16a733c0492

SHA512
4a18d2ae14533609b2aa3fa8b0f8d2030a74369cdf197aeedef2e9579bbd350c409f91a6af3d10bb8a73dc902d37200397633d6ca75dc653ec85514b0fc5a1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84a1619d443106bdc7472772f0928101

SHA1
b47e6b82da75bd5c609e500e0fec6da1f6dfe537

SHA256
0cdec945f366580b8b5d26683ba06091b440941c0b474800f686ab00447e5ad8

SHA512
2319244330c5e1090a29003f629c814b67c60a2e123628d133a6696a1edebb32fac0d355edfd985f79fecf9e4317b7e754dd38d8d57a2835ec6641ef0d6e5c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edb6e6082c0892daf57e0b7b39b14f52

SHA1
26196cb10206f02318bc200972c230c359010d03

SHA256
c97d6dc2d784b25c2d47a0180f07e388c28be1c5ad78a85c633a16832ffdc8f9

SHA512
66efe803205ddb6c140a37b0e65be7c44f6475199a4386ba18e3078c51968a780f4b9fd26c19dd78460b5752f8c94cefaf30760a08f5c2a18e3fb4729598de25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84499d5b76729eb36fa745d8bebfbb9f

SHA1
7e75ac8c80acf343db2dce43f740681819a5a92c

SHA256
d42c9bfdb854da784917877af1aa3f59b379a4abef66e5c9efa64fa7b9a206d2

SHA512
078604a25a9a71760fc804f696a1732a6cfd9c377baeb3bbefccbb08e17b7d927183c035592ec2d67ff025172133d0c558d606b977ebde24db132bc510847ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2aac04f1e57bba6447eb782d624eabf

SHA1
0df179f44de020da54244a818ba46b85059aa5b7

SHA256
d8ce04db6affd1320a85ee87b7bf61df639c8672a0c75577cee9adb79c5e173d

SHA512
3c0f24b8f0ef92e4b14b74a46628768cc3a71f85847cd1381f41a032421d589d9367ac85653717a6d9631a4297b29d52dee539e67ae4b22d80fbe40fcb8b54c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecaa3c9f85d2ec5b1e13a83d047ec462

SHA1
df37b47a3d65381ec1789ff03a472578f1bf7f4e

SHA256
99d1f8b1e0eaf6d1a95149f23a0ace57979cc3f854d03c82ceee52ab1880482e

SHA512
7e0ed8c1ab06c1c80eeff0edb32a9cdc9fcd2530eb6ea1636237efe7722d2b7d7a6cec0a98462b947e90995698d30509236a0c23720c509609f5a5acb0414504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5a4b8072dd365da3e00956978ce676c

SHA1
efe5db53cf148fa2c65b0ffa0a01bcf40bd87db3

SHA256
987fbd76ed26a54f2484aa6eb153b60297af54404f9efff53b40b8069739fb8e

SHA512
55352e761d30168208201cb575cbce19cfabdb62faca2a3b80646a629f9870fcc0016902f22a9cb044c32e985312c3e35e9d2ae32064d1d180d7fec1f9374199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37db10edcccf6a724cd6dc23ebda32c1

SHA1
17e60378ee91d837953150e987a8d1168d5e56aa

SHA256
2879acc43a53331d47cd794f11d1833e50dbc774a036ca405ca42854cfd34523

SHA512
2de916c8980309e89578077d2dc120449786e7f49d7bcb0cc27bc2b14d0a40f3ba651e4f81a1677055a8a22af2db5021a3297bb334bc8a7cd555b418744bb663

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF01.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEFC1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit